# Benign esfrxETH holders incur more loss than expected

esfrxETH holders front-run rebalancer withdrawal requests to exit before FRAX's unstaking fee hits, leaving remaining holders to absorb the entire pro-rated loss.

- Payout: Contest reward
- Severity: medium
- Program: Napier
- Credited: xiaoming90
- Disclosed: 2024-01-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-napier-judging/issues/82
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:race-condition vuln:reward-distribution

**Target:** SFrxETHAdapter (esfrxETH vault adapter)
**Root cause:** FRAX charges a fee on withdrawal requests that reduces esfrxETH share price, intended to be pro-rated across all holders; but deposits/withdrawals are fee-free, so holders can exit before the fee and re-enter after, dodging their share.
**Steps:**
1. Monitor mempool for rebalancer's withdrawal request TX to FraxEther redemption queue.
2. Front-run it: withdraw all esfrxETH shares from SFrxETHAdapter (no fee).
3. Rebalancer TX executes; FRAX fee reduces share price, borne by remaining holders.
4. Deposit back into adapter at reduced share price, capturing the avoided loss.
**How found:** Read the adapter's own security note stating FRAX withdrawal fee is pro-rated among holders and only rebalancers may request withdrawals; reasoned that mempool visibility of the rebalancer TX plus fee-free deposit/withdraw lets holders front-run the fee.
**Exploitation:** Attacker watches mempool for authorized rebalancer's withdrawal request, front-runs with a fee-free withdrawal, lets the fee reduce share price, then redeposits; profit exceeds gas cost.
**Insight:** When a protocol documents that a cost is 'pro-rated among holders' but entry/exit is free, check whether mempool-visible privileged transactions (rebalancer withdrawals) let holders front-run the cost event and re-enter after; private RPC is the only mitigation.